It happens sometimes [1] [2]. Reduced malware and quick removal is all you can hope for.
I have an app in the Play Store and received some unsolicited requests to install (and get paid for!) adding some extra jar file to my app and hosting someone else's apps in my account. Attackers put in a lot of effort to sneak in.